Welcome to Your OSCAL Toolkit
This compliance automation toolkit provides a vendor-neutral, open-source foundation for managing
security and compliance across multiple frameworks. Built on NIST OSCAL standards, it enables
organizations to automate compliance workflows, reduce audit preparation time, and maintain
continuous compliance monitoring.
Supported Frameworks
SOC 2
Trust Services Criteria
Security, Availability, Processing Integrity, Confidentiality, and Privacy principles
for service organizations.
5 Trust Principles
ISO 27001:2022
Information Security Management
International standard for establishing, implementing, maintaining and continually
improving an information security management system.
93 Controls
NIST CSF
Cybersecurity Framework
Framework for managing and reducing cybersecurity risk through Identify, Protect,
Detect, Respond, and Recover functions.
5 Core Functions
NIST 800-53
Security and Privacy Controls
Comprehensive catalog of security and privacy controls for federal information
systems and organizations.
1000+ Controls
View on GitHub →
NIST Frameworks
NIST Cybersecurity Framework (CSF)
The framework consists of five concurrent and continuous functions: Identify, Protect, Detect,
Respond, and Recover.
IDENTIFY
Asset Management, Risk Assessment
Develop organizational understanding to manage cybersecurity risk to systems, people,
assets, data, and capabilities.
6 Categories
PROTECT
Access Control, Training
Develop and implement appropriate safeguards to ensure delivery of critical services.
6 Categories
DETECT
Monitoring, Detection Processes
Develop and implement activities to identify the occurrence of a cybersecurity event.
3 Categories
RESPOND
Incident Response, Communications
Develop and implement activities to take action regarding a detected cybersecurity incident.
5 Categories
RECOVER
Recovery Planning, Improvements
Develop and implement activities to maintain plans for resilience and restore capabilities
or services impaired due to a cybersecurity incident.
3 Categories
NIST SP 800-53
Comprehensive catalog of security and privacy controls for all types of computing platforms.
AC - Access Control
25 control families covering account management, access enforcement, information flow
enforcement, and least privilege.
SI - System Integrity
Controls for flaw remediation, malicious code protection, information system monitoring,
and security alerts.
IR - Incident Response
Incident response training, testing, monitoring, reporting, and response plan requirements.